Repository navigation
feat: flag-gated slices of spikes 637, 639, 640, 641 (SEP-10 sessions, network config, age gating, licensing) - #577
Merged
Darkvader-ship-it merged 1 commit intoOct 18, 2026
Conversation
…onfig, age gating, licensing) Spike 641 (SEP-10 web auth): - lib/sep10-auth.ts: challenge build/verify via WebAuth, single-use challenges, opaque hashed bearer sessions with 1h TTL - GET /api/auth/challenge, POST/DELETE /api/auth/session - flag phase-162 Spike 640 (mainnet readiness): - lib/stellar-network.ts: STELLAR_NETWORK selects canonical passphrase, conflicting overrides throw, mainnet requires PHASE_MAINNET_CUTOVER_ACK=1 - viewer-authorization now resolves its passphrase through this module - flag phase-163 Spike 637 (age gating): - lib/age-gate.ts: conservative band from birth year, first declaration final, only the band is persisted - POST /api/age-gate/declare bound to the session wallet - POST /api/world accepts age_gate 18+/21+, returns 451 AGE_GATE_REQUIRED - flag phase-164 Spike 639 (licensing attestation): - lib/license-attestation.ts: PHASE_LICENSE_ATTESTATION_V1 canonical message, rights taxonomy with evidence rules, nonce-unique, one per collection - POST /api/world requires license_attestation on first creation when enabled - flag phase-165 Docs: PROJECT_ARCHITECTURE.md flag rows, docs/TECHNICAL.md env/sidecar section. Closes PHASE-STELLAR#503 Closes PHASE-STELLAR#502 Closes PHASE-STELLAR#499 Closes PHASE-STELLAR#501 Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
|
@UltimateUser1 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
First flag-gated slices of four spikes. Each one ships default-off behind its own
phase-*flag, so nothing changes for existing users until the flag is set.phase-162phase-163STELLAR_NETWORKpicks the canonical passphrase. A conflicting override throws. Mainnet needsPHASE_MAINNET_CUTOVER_ACK=1. The viewer gate now resolves its passphrase through this module.phase-164age_gate: "18+" | "21+"requires a creator session and an age that meets the gate, otherwise451 AGE_GATE_REQUIRED.phase-165PHASE_LICENSE_ATTESTATION_V1declaration. Rights basis is one of five values, and non-original bases needevidence_cid. Nonces are never reused and each collection is declared once.Scope honesty
The four issues are written as 4–8 week spikes with testnet tx-hash proofs and full acceptance criteria. This PR does not claim to meet all of them. The gaps are listed below and recorded in
PROJECT_ARCHITECTURE.md§10 anddocs/TECHNICAL.md§15.acting_wallet/X-Wallet-Addressroutes are not migrated to sessions. No client wallet-kit flow yet.Config
SEP10_SERVER_SECRET(server only),SEP10_HOME_DOMAIN,SEP10_WEB_AUTH_DOMAINSTELLAR_NETWORK(testnetdefault),PHASE_MAINNET_CUTOVER_ACKFEATURE_PHASE_162…FEATURE_PHASE_165(or theNEXT_PUBLIC_variants)Rollback
Unset the flags and restart. Auth routes return 404, gated world creation is ignored, and license attestation is no longer required. The new sidecars (
auth-sessions.json,age-declarations.json,license-attestations.json) stay on disk and are inert.Closes
Closes #503
Closes #502
Closes #499
Closes #501